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For the realization of quantum key distribution, it is important to investigate its security based 
on a mathematical model that captures properties of the actual devices used by the legitimate users. 
Recently, Ferenczi, et. al. (Phys. Rev. A 86 042327 (2012)) pointed out potential influences that 
the losses in phase modulators and/or the unbalance in the transmission rate of beam splitters may 
have on the security of the phase-encoded BB84 and analyzed the security of this scheme, which is 
called the unbalanced BB84. In this paper, we ask whether blindly applying the post-processing of 
the balanced BB84 to the unbalanced BB84 would lead to an insecure key or not, and we conclude 
that we can safely distill a secure key even with this post-processing. It follows from our proof that 
as long as the unbalances are basis-independent, our conclusion holds even if the unbalances are 
unknown and fluctuate in time. 



I. INTRODUCTION 

Quantum key distribution (QKD) is a protocol to share 
the secret key between two authenticate parties (Alice 
and Bob) with negligible leakage of its information to an 
eavesdropper (Eve). The advantage of employing QKD 
is that it can achieve the unconditional security, which 
is the security against any possible attack allowed by the 
law of quantum mechanics under some assumptions on 
the devices used by Alice and Bob. 

The first QKD protocol was proposed by Bennett and 
Brassard at 1984 [jj (the protocol is called BB84 proto- 
col). Since this proposal, many works have been devoted 
to prove the unconditional security [2|-|7| , and some works 
take into account practical imperfections of the devices 
used by Alice and Bob [8T4l0j. It is important that a 
mathematical model of Alice and Bob's devices is needed 
to prove the security of a QKD protocol, and thus the 
model should reflect the actual imperfections of the de- 
vices for the realization. 

In this paper, we consider the effect of the losses in 
phase modulators and the unbalance in the transmission 
rate of beam splitters in the phase encoded BB84. This 
practical imperfection is firstly pointed out by Ferenczi, 
et. al. [llj]> and this scheme is referred to as the un- 
balanced BB84. Since the actual phase modulators have 
inevitable losses and the transmission rate of actual beam 
splitters cannot be exactly 50%, it is important to ana- 
lyze the security of the protocol in order to fit the theory 
to the actual situation. The security of this protocol has 
been analyzed by Ferenczi, et. al. [ll| based on the se- 
curity proof fl2l [T3 |. In their proof, however, it is not 
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clear whether blindly applying the post-processing for 
the standard (balanced) BB84 would lead to an insecure 
key or not. 

The purpose of this paper is to provide the uncondi- 
tional security proof of the unbalanced BB84 by showing 
that any security proof of the balanced BB84 where Eve is 
allowed to distribute Alice and Bob a basis-independent 
state, for instance the security proof based on comple- 
mentary scenario Q or Shor-Preskill type proof can 
be directly applied to the unbalanced BB84. This means 
that we can safely perform the data processing for the 
key distillation as if there were no unbalance and the 
unbalance only changes experimental data. Moreover, a 
natural consequence of our security proof is that as long 
as the unbalances are basis-independent, our conclusion 
holds even if the unbalance in Alice and Bob is unknown 
and fluctuate in time. 

In order to see the performance of the unbalanced 
BB84, we simulate the resulting key generation rate as a 
function of the distance between Alice and Bob. Follow- 
ing the work by Ferenczi, et. al, we consider two cases: 
the first case is that we employ the unbalanced BB84 
as it is and the second one is that we apply additional 
attenuations to Alice and Bob's devices in order to bal- 
ance the intensities of the double pulses and to eliminate 
the effect of the unbalance in Bob's measurement. We 
call the second case as the BB84 with the hardware fix 
or the hardware fix scenario, and this case is essentially 
the same as standard BB84 with additional losses. By 
simulating the key generation rates for the two cases, we 
have obtained almost the same threshold distance of the 
key generation in pd| and confirmed that the key rate of 
the BB84 with the hardware fix is lower than that of the 
unbalanced BB84 [ll | . 

The organization of this paper is as follows, In Sec. [Til 
we briefly review the protocol of the unbalanced BB84. 
In Sec. IIII1 we first briefly review the security proof of the 
balanced BB84 and prove the unconditional security of 
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the unbalanced BB84. In Sec. IIV1 by assuming the use of 



the decoy state [14j , we simulate the key generation rates 
of the unbalanced BB84 and the BB84 with the hardware 
fix. The key rates are plotted as a function of the distance 
between Alice and Bob by taking experimental data from 
GYS experiment [l5j |. Finally, we summarize this paper 
in Sec. M 



II. UNBALANCED BB84 

In this section, we introduce the unbalanced BB84. 
The experimental setup of the unbalanced BB84 is de- 
picted in FIG. [1] The unbalanced BB84 is the standard 
phase encoded BB84 protocol using phase randomized 
weak coherent pulses where the intensities of the double 
pulses are not the same because of the imperfections of 
the phase modulators and/or the beam splitters. For the 
simplicity of the discussion, we assume that the phase 
modulators possessed by Alice and Bob have the same 
transmission rate n and we do not explicitly consider the 
unbalance of the beam splitters, i.e., all the relevant beam 
splitters are assumed to have 50% of transmission rate, 
but the generalization of our analysis is trivial. 

In Alice's side, a phase randomized coherent pulse from 
her laser source splits into two arms Al and A2 by a bal- 
anced beam splitter BS1. Alice randomly applies phase 
modulation 9 = {0, 7r/2, it, 37r/2} to the pulse passing 
Al by the imperfect phase modulator PMA. Here, the 
phase 9 = {0, ir} ({tt/2, 3tt/2}) is defined as the bit value 
{0, 1} in X (Y) basis (for the later convenience, we use 
W = X, Y to refer the basis) . The pair of the pluses 
come from Al and A2 is sent to Bob via another bal- 
anced beam splitter BS2. Because of the imperfection 
of PMA, the state of the pulses sent by Alice becomes 
\e^ +e ^ ^/ko) Je 11 ' ^/a) r , wnere subscripts s and r respec- 
tively denote the signal pulse passed through Al and ref- 
erence pulse passed through A2, and (, is the random 
phase chosen between and 2-7T. 
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Al and A2. Thanks to his interferometer, the pair of 
the incoming pulses is finally separated into three pulses 
which can be distinguished by the detection time of the 
detectors, and we only consider the pulses arriving at 
the intermediate time. Bob applies the phase modula- 
tion 4> randomly chosen from {0,7r/2} to the pulse pass- 
ing through Bl by the imperfect phase modulator PMB. 
Here, the phase modulation (tt/2) is defined as X (Y) 
basis in Bob's measurement. As the result of Bob's phase 
modulation, the state of the pulses arriving at the beam 
splitter BS4 becomes \e l( <+^ > i(c+ ^v^?) r5 and 
state at the detector DO (Dl) becomes |e^ e * ^ 

e l< > e \J~kP) J • Bob records the bit value (1) when 

DO (Dl) clicks, and Bob randomly assigns a random bit 
to the double click event if the double click event occurs 
due to noises such as the dark counting of the detectors 
or misalignment. After Bob's measurement, Bob broad- 
casts his basis, and Alice and Bob keep the data with 
the bases matched. One can see that Bob can obtain the 
same bit value with Alice when there are no noises. 

We note that we make the following assumption on 
Bob's detection device: the POVM element corre- 
sponding to the failure detection of the bit value in W 
basis is basis-independent, i.e., 
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_ p(f) 

r X ~ r Y 



(1) 
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Therefore, we consider Bob's W basis measurement is 
constructed by a basis-independent filter Feob followed 
by Bob's two-outcome, i.e., Bobs bit value, W basis 
measurement Mw We note that the squash model 
[Tol [lrjl Kt\ is not necessary in our proof. 

We remark that since each of the signal and reference 
pulses of our interest passes through the phase modulator 
only once, we do not need to equalize the intensities of 
the pulses in order to suppress the bit errors. However, 
just for the comparison, we consider the case where we fix 
the unbalance by implementing the beam splitters with 
the transmission rate of k to the paths of A2 and B2 
(see also FIG. [2]). We call this scenario as the BB84 with 
hardware fix or the hardware fix scenario, and we can 
regard this case as the ideal BB84 with the additional 
attenuation. We will compare the key generation rates 
of both of the cases by the key generation simulations 
in Sec. IIV1 and we confirm that the unbalanced BB84 
protocol has larger key generation rate than the BB84 
with the hardware fix. 
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FIG. 1: Description of our model of the unbalanced BB84 
protocol. PMA and PMB are the lossy phase modulators 
with the transmission rate of k. Note that our proof is valid 
even if the unbalances in Alice and Bob's sides are different 
and unknown. 

In Bob's side, the optical length difference between 
Bl and B2 is adjusted to the same as the one between 



III. SECURITY PROOF 

In this section, we prove the unconditional security of 
the unbalanced BB84 protocol based on complementar- 
ity scenario [5J. We consider only the single-photon part 
(n = 1) since we may not be able to or may have very lit- 
tle chance to generate the key from multi-photon part due 
to the so-called photon-number splitting (PNS) attacks 
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FIG. 2: (a) is the interferometer in the unbalanced BB84. 
(b) is the interferometer for the BB84 with the hardware fix. 
In (a) and (b), the loss in the phase modulator is modeled 
by the additional beam splitters with the reflection rate of 
1 — k preceded by the lossless phase modulator (PM). (b) is 
equivalent to (c). 



[l8|. In order to treat the photon number separately, 
we apply the argument by GLLP [To| or by Koashi 
For the simplicity of the discussion, we assume that the 
key is generated from the states of X basis, and there- 
fore the states of Y basis are only spent in the parameter 
estimation, i.e., the so-called phase error estimation. 



A. The state of Alice and the brief review of the 
security proof of the balanced BB84 

Before the proof, we would like to discuss Alice's 
source. Thanks to the phase randomization, the density 
matrix of the pulses sent by Alice becomes the mixture 
of the eigenstates of the photon number n (we rewrite 
the eigenstates as \o$)b) as follows 



qubit states as follows: \jx) = A% (|0z) + (— 1) J 1 1^)) and 
\]y) = ^(e-**|0 z ) + (-LpVf |l z )) where j = 0,1. 

In the following two paragraphs, we briefly review the 
essential point of the security proof of the balanced BB84. 
In GLLP argument or the argument by Koashi in 
[l9| , we ask whether the privacy amplification succeeds if 
it is applied only to the qubits associated with the single- 
photon emission, and it is shown that we can generate 
the secret key with asymptotic key generation rate R as 
follow [H. 



R = - lx f(Ex)h(E x ) +1 ^[l - h(e^>)] . (3) 

Here, is Y basis fictitious bit error rate that would 
have been obtained if Alice had sent a single-photon in 
X basis and Alice and Bob had employed Y basis for 
the measurement, Ex is the bit error rate from the X 
basis measurements when Alice sends a pulse in X basis, 
7x is the rate of Bob's detection in X basis (7^ is the 
part of 7x where Alice sends a single photon), f(Ex) is 
the inefficiency of the error correcting code, and h(x) = 
-xlog 2 x- (1 - x) log 2 (l - x). 

Note that what the actual experiment gives Alice and 
Bob is the bit error rate in Y basis Ey when Bob chooses 
Y basis and Alice sends a pulse in Y basis rather than 
a single-photon in X basis. By using GLLP argument 
or combining GLLP argument with the decoy state idea 
[li]], we can estimate the lower bound of ey ', which is 
the contribution from Alice's single-photon emission in 
Ey, but this quantity is different from e^ 1 -*. In the bal- 
anced BB84, it turns out that these quantities match 
(ey^ = ey 1 ^) . The most important point to derive 
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in the balanced BB84 is the basis indepen- 



dence of the state Alice prepares and of Bob's detection 
Eq. (1). Thanks to this independence, Eve cannot be- 
have differently between X and Y basis so that we have 
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@, EH Ell ■ In what follows, we prove that 
is also the case for the unbalanced BB84, 
which means that we can perform the data processing in 
the unbalanced BB84 as if there were no unbalance. 



(2) 



where W € {X, Y} and a E {0, 1} are the basis and 
bit value Alice chooses for sending the pulses (W and 
a in right-hand side corresponds to 8 in the left-hand 
side), P is defined as P(\ip)) — an d the sub- 

script B represents the system to be sent to Bob. The 



single-photon part (n = 1) of 



l X IB 



b is described as 



;(\0 z )b + (-l) a ^|lz>B) and K% 



^jL=(e -i S|0z) B + (-l) a ^/Ke l2 i\l z }B), where we define 
\0z)b = \0) s \l) r and \1 Z ) B = |l) s |0) r . For the later con- 
venience, we define the relationships of the eigenstates of 



B. Security proof of the unbalanced BB84 

For the security proof, we first consider a virtual pro- 
tocol where we change the method to determine Alice's 
bit value a. In the virtual protocol, she firstly generates 
\^w n) )AB with the probability 
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l^M (4) 



where the subscripts A and B respectively denote Alice's 
and Bob's system, which is mathematically expressed by 
Hilbert space Ha Hb ■ After generating the state, she 
conducts W basis measurement on her qubit, and she 



4 



records the measurement outcome as her bit value a in 
W basis. Finally, she sends the system B to Bob. We can 
confirm the state sent to Bob is equivalent to the actual 
protocol. In the virtual protocol, it does not matter if 
Alice delays her measurement after sending the state, 
and hence we assume this delay hereafter. 

From the definition of \^y')ab and I'&J }ab, one 



x 



can easily confirm that \^ x (x '}ab = \^f Y )ab, i.e., 
the state of the single-photon in the virtual protocol is 
basis- independent. By combining this independence with 
the basis-independence of Bob's measurement, we have 

e Y = e y^- This ends the proof. 

As an alternative proof (also see FIG. [3]), we further- 
more modify the single-photon part of the virtual pro- 
tocol that is equivalent to the single photon part of the 
unbalanced BB84 protocol. Let i*AUce = V~k\0z)a(0z\ + 
\1z)a(1z\ be Kraus operator corresponding to the suc- 
cessful event of her filtering operation. In the modified 
protocol, Alice first prepares a basis-independent joint 
state \^+) AB = -^(\0z)a\1z)b + \1z)a\0z)b), performs 
the filtering operation, and then she keeps only the suc- 
cessfully filtered state. We can confirm that the fil- 
tered state satisfies Faucc <& 1_b| v I /+ ) j 4_b c< \^ x )ab = 
/AB) which means that the post-selected state is 
also basis-independent. This ends the alternative proof. 

In summary, we can prove the security of the unbal- 
anced BB84 protocol by directly confirming the basis- 
independence \^ x ^)ab — \^y^)ab together with the 
basis-independence of Bob's measurement. Alternatively, 
we consider the virtual protocol for the single-photon 
part, which is constructed by the preparation of the Bell 
state \V+)ab = ^ (\0 z )a\1z)b + \1z)a\0 z )b) followed 
by each side of basis-independent filtering operation with 
-pAlice and /"Bob, the post-selection, and each side of the 
two outcome measurements of W basis. The two outcome 
measurements consist of Mw in Bob's side and projective 
W basis qubit measurement Pyy in Alice's side (depicted 
in FIG. El ■ This virtual protocol is composed only by 

basis-independent operations so that we have = e^ 1 '. 

From the above discussion, we conclude that the key 
generation rate of the unbalanced BB84 protocol is writ- 
ten as 



R=-j x f(E x )h(E x ) 



7 «[1-Me^)]. 



(5) 



This formula is completely equivalent to the rate of the 
balanced BB84 [l(| Q ■ Therefore, we can perform 
the data processing in the unbalanced BB84 as if there 
were no unbalance. The unbalance affects only the re- 
alization of the experimental data as we will see in the 
next section, and it never affects the key formula itself. 

We remark that we have used only the basis inde- 
pendence of the unbalance in our security proof. Thus, 
it follows that as long as the unbalances are basis- 
independent, our conclusion holds even if the unbalance 
of the sending pulses and that of the measurement are 
unknown and fluctuate in time. It also follows that if we 
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FIG. 3: Description of the virtual protocol for the single- 
photon part in our alternative proof. Alice (Bob) conducts 
the two outcome measurement of W basis which consists of 
Pw (Mw) following the post-selection by each side of the 
filters. Note that the filtering operations Faucc and Fsob are 
basis-independent, and as a result we can safely apply the 
security proof of the standard BB84 to the filtered state. 



use the so-called squash operators [lfj, [l6|, [l7| for Bob's 
measurement satisfying Eq. ([T]), which is shown to exist 
in , then one can draw the same conclusion even when 
one uses any proof technique of the balanced BB84, in- 
cluding Shor-Preskill type security proof 0,13], where Eve 
is regarded as the sender of a basis- independent quantum 
state to Alice and Bob. 



IV. SIMULATION 



In this section, we simulate the key generation rate 
by using the typical experimental parameters taken from 
the Gobby- Yuan- Shields (GYS) experiments [l^]. In the 
simulation, we assume the use of infinite number of decoy 
states to obtain 7^ and ■ We also assume that the bit 
error only stems from the dark counting of the detectors, 
and therefore, we ignore the probability of the error stem- 
ming from the misalignment and other imperfections of 
the devices. In order to ensure the basis-independent de- 
tection (Eq. (JTJ), we assume that the quantum efficiencies 
of the two detectors are the same and the inefficiency of 
the detector can be modeled by a beam splitter preceded 
by a detector with unit quantum efficiency Moreover, 
we assign a random bit value to the double click event. 



With all the assumptions, we may have the following 
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experimental data. 
P =ar] 

lx =[l-(l-p d )e- K/3 ](l-p rf ) 

+ {I- Pd )e- Kf3 Pd + [!-{! - Pd )e 



-K0 



Ex ={(1 -Pd)e-« p p d + -[1 - (l-Pd)e- re/3 ]p d }/7x 

=e-( 1+K)a, Q!(l + K) 
7 « ^-(l-p^l-r^)]^-^ 



+ (l-Pd)(l-»/T 



-)Pd 



+ [l-(l-Pd)(l-77 



1 



(i) 



e« ={(l-P«j)(l-»? 



1 + K 



+ 1[1 - (1 - p d )(\ - V -—)]p d }pW/ 1 
2 1 + K 



(6) 



Here, is the dark count rate of each of the detector 
DO and Dl, 77 is the overall transmission rate, rj det is the 
quantum efficiency of the detectors Dl and D2, £ is the 
channel transmission rate, and I is the distance between 
Alice and Bob. 

We also simulate the case of the hardware fix scenario. 
In this case, some values of the parameters change as 
follows. 



lx =[l-(l-p d )e- K )(1-Pd) 

+ (1 - Pd )e- K ^ Pd + [!-(!- Pd )e- K2 P] Pd 



E x ={(1- Pd ) e - K Pp d 

p (l) =e -2» 2m 

7 ^ ={[1-(1- Pd )(l- 



-[l-{l-p d )e-^f 3 ]p d }/ 1} 



m-Pd) 



rjn, 



+ (l- Pd )(l-J-) Pd 



+ [i-(i- w )(i^)W/> 



e£> ={(l- Pd )(l-^) Pd 

+ ^[l-(l-w)(l-y)Wp (1) M 1) 



rjK, 



(7) 



We take the following parameters from the GYS ex- 
periments 0]: f(E x ) = 1.22, p d = 8.5 x 10~ 7 , £ = 
0.21 [dB /km], and r/det = 0.045. The result of the simu- 
lation is shown in FIG. 2] where we have optimized the 
intensity of the pulse (a), and the optimum intensity is 
depicted in FIG.0 We obtain almost the same transmis- 
sion distances as those in [ill ]. Furthermore, we can con- 
firm that the hardware fix scenario causes the decrease 



in the key generation rate (the same tendency is also 
obtained by the work by Ferenczi, et. al. [1JJ). This 
decrease is due to the additional loss in the hardware fix 



scenario. 
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FIG. 4: Key generation rates of the unbalanced BB84. The 
thick line is a ideal phase encoded BB84 (k — 1), the thin 
line is the unbalanced BB84 (k = 1/2), and dashed line is the 
BB84 with the hardware fix (« = 1/2). 



1.0 F 
0.9; 

0.8 1 

1 0.7^ 
u 

c 

0.6; 
0.5 ;■ 

0.4 1 



20 40 60 80 100 120 140 
Distance[km] 



FIG. 5: Optimal intensity a that results in each of the opti- 
mal key generation rate in FIG. [4] 



V. SUMMARY AND DISCUSSION 

In summary, we have proved the unconditional security 
of the unbalanced BB84 protocol. For the security proof, 
we have considered the virtual protocol that is equiva- 
lent to the unbalanced BB84 protocol. In the proof, we 
have confirmed that the single photon part of the virtual 
protocol is basis-independent or this part is constructed 
by the preparation of the Bell state followed by each side 
of the basis-independent filtering operations, and each 
side of the two outcome measurements. Thanks to the 
basis-independence in the virtual protocol, we have con- 
cluded that we can apply the method of security proofs of 
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the balanced BB84 Therefore, we can conduct the 

data processing for the key distillation as if there were no 
unbalance and the unbalance has influence only through 
the realization of the experimental data. We note that a 
natural consequence of our security proof is that as long 
as the unbalances are basis-independent, our conclusion 
holds even if the unbalance of the sending pulses and that 
of the measurement are unknown and fluctuate in time. 

Finally, by the simulation, we have also compared the 
key generation rates of the unbalanced BB84 and the 
BB84 with the hardware fix, and confirmed that the 
hardware fix scenario causes the decrease in the key gen- 
eration rate and the transmission distance. 
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